Through the introduction of https://www.cnblogs.com/zpchcbd/p/12308184.html
We all know that the data between sections with section data are stored according to the document alignment
PE files in two states, one state is in the hard disk, one is the state in memory, the articles are talking about the state of the hard disk storage time
For example, FIG:
Our alignment is in accordance with 0x200 stored in the file. And in memory is in accordance with 0x1000. 1000. The assumption is that extra space fill 0
Our portion DOS header + + PE section table, then according to the stored document alignment, data section 400 from the beginning
However, memory is not the same. If the alignment according to 0x1000. So in the memory 1000 is a starting position of the data section, 0x1000 depending on _IMAGE_OPTIONAL_HEADERstructural body SectionAlignmentmembers, as shown, 0x1000 began!
